ClawHub
Back to skill

Security audit

交付文档

Security checks for vulnerabilities and agentic risk

Overview

This document-generation skill is mostly coherent, but it directs agents to save delivery documents and use connected Notion/Feishu/Linear/Jira systems without clear confirmation, scope, or sharing controls.

Review generated documents before saving or publishing, especially sections containing deployment environments, access URLs, account information, customer details, and internal project status. Only use Notion/Feishu or Linear/Jira connectors when you understand which workspace, project, and audience will be involved.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill instructs that all generated documents be saved as files by default, but it does not require user confirmation, disclose where the file will be written, or warn that potentially sensitive project and client data may be stored locally. In a delivery-document skill, outputs commonly contain deployment details, contacts, account information, or internal architecture, so silent local persistence creates a real confidentiality and data-handling risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill proposes publishing documents to Notion/Feishu and pulling issue/project data from Linear/Jira without any notice about external data transfer, access scope, or sensitivity review. Because delivery reports may include internal progress, deployment environments, and customer information, connector-based export and retrieval can expose confidential data to third-party services or broader audiences than intended.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The operational instructions and invocation examples are entirely in Chinese, which can effectively force a specific language for interaction and output. There is no statement that users may choose another language, nor a documented reason that the skill must be Chinese-only.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown file contains only Chinese-language instructions and examples, with no indication that the user can choose another language or that the template is intentionally limited to a Chinese-speaking audience. Under the language/locale policy rule, forcing a specific language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.